Hi @SOClife
The only documented APIs for ES8 specifically are at https://docs.splunk.com/Documentation/ES/8.0.2/API/AboutSplunkESAPI and as you say, the investigation API isnt listed in here.
However - I believe some of the investigation endpoints you are looking for are actually now under the Mission Control app (See the MC APIs at https://docs.splunk.com/Documentation/MC/Current/SplunkPlaybookAPI)
If you view an investigation in the UI with the Network tab of the browser developer tools open then you will see API calls to <yourEnv>/en-US/splunkd/__raw/servicesNS/nobody/missioncontrol/v2/investigations/<GUID>/findings (for example!) - some of these map to the documented MC APIs, however I couldnt find all of them in there. Its worth capturing the payload and responses to determine what you need from them.
As another example, loading the Incident Review in the UI loads some MC V1 API calls such as the notes endpoint.
In addition to the API calls, if you're extracting information about incidents/investigations then you may be able to perform standard SPL searches using the REST API,
| mcincidents < This will return a list of incidents within the timeframe searched
| mcincidentbyid id=ES-00001 < Return a single incident details, pass display_id or id (guid)
🌟 Did this answer help you? If so, please consider:
- Adding kudos to show it was useful
- Marking it as the solution if it resolved your issue
- Commenting if you need any clarification
Your feedback encourages the volunteers in this community to continue contributing.
